PT-2026-57406 · WordPress · Wcfm – Frontend Manager For Woocommerce

Mrholmes + 1 · Published 2026-07-11 · Updated 2026-07-11 · CVE-2026-10041

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WCFM – Frontend Manager for WooCommerce versions prior to 6.7.28

Description An Insecure Direct Object Reference (IDOR) exists in the wcfm product archive endpoint due to missing validation on a user-controlled key. This allows authenticated attackers with subscriber-level access or higher to archive products of arbitrary vendors, toggle the featured status of arbitrary listings, mark arbitrary WooCommerce orders as completed, and permanently delete bulk messages and enquiries belonging to other vendors.

Recommendations Update WCFM – Frontend Manager for WooCommerce to version 6.7.28 or later.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-10041

Affected Products

Wcfm – Frontend Manager For Woocommerce

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2026-10041 · Security Note
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3588570%40wc-frontend-manager&new=3588570%40wc-frontend-manager · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e3f88a18-5439-4759-ae9f-168f5efc3264?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.26/core/class-wcfm-ajax.php#L779 · Note
• https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.27/core/class-wcfm-ajax.php#L810 · Note
• https://twitter.com/CVEnew/status/2075869764941938833 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.26/core/class-wcfm-ajax.php#L810 · Note
• https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.27/core/class-wcfm-enquiry.php#L395 · Note
• https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.26/core/class-wcfm-ajax.php#L746 · Note
• https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.27/core/class-wcfm-ajax.php#L779 · Note
• https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.27/core/class-wcfm-ajax.php#L746 · Note
• https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.27/core/class-wcfm-notification.php#L1132 · Note
• https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.26/core/class-wcfm-enquiry.php#L395 · Note
• https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.26/core/class-wcfm-notification.php#L1132 · Note